From ea7d17ef13408254e536508540618f893894e275 Mon Sep 17 00:00:00 2001 From: ightevenmckane187 <214069160+ightevenmckane187@users.noreply.github.com> Date: Thu, 20 Aug 2026 21:57:52 +0000 Subject: [PATCH] fix(security): resolve syntax error and replace Buffer.allocUnsafe with Buffer.alloc in PersistenceLayer --- src/os/persistence/PersistenceLayer.ts | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/src/os/persistence/PersistenceLayer.ts b/src/os/persistence/PersistenceLayer.ts index b60a349..9dac331 100644 --- a/src/os/persistence/PersistenceLayer.ts +++ b/src/os/persistence/PersistenceLayer.ts @@ -15,28 +15,19 @@ export class PersistenceLayer { const payload = JSON.stringify(data); const payloadBuf = Buffer.from(payload, 'utf8'); - // Bolt Optimization: Allocate unsafe buffer for exact combined size to avoid Buffer.concat and intermediate payload allocations - const outBuf = Buffer.allocUnsafe(38 + payloadBuf.length); - - // Copy pre-allocated header and payload - outBuf.set(HEADER_BUF, 0); - outBuf.set(payloadBuf, 38); - - // Compute and write HMAC signature directly - const hmac = crypto.createHmac('sha256',. key); + // Compute HMAC signature over payload buffer + const hmac = crypto.createHmac('sha256', key); hmac.update(payloadBuf); const signature = hmac.digest(); - outBuf.set(signature, 6); - const payloadByteLength = Buffer.byteLength(payload, 'utf8'); - const out = Buffer.allocUnsafe(HEADER_LENGTH + SIGNATURE_LENGTH + payloadByteLength); + const payloadByteLength = payloadBuf.length; + // Use Buffer.alloc to avoid uninitialized memory hazards + const out = Buffer.alloc(HEADER_LENGTH + SIGNATURE_LENGTH + payloadByteLength); - // Zero-copy set of pre-allocated header + // Copy header, signature, and payload out.set(HEADER_MAGIC, 0); - // Zero-copy set of hmac signature out.set(signature, HEADER_LENGTH); - // Direct UTF-8 write of the payload to avoid intermediate Buffer allocation - out.write(payload, HEADER_LENGTH + SIGNATURE_LENGTH, payloadByteLength, 'utf8'); + out.set(payloadBuf, HEADER_LENGTH + SIGNATURE_LENGTH); return out; }